1.6a Meeting Follow Up Doshi Flashcards
(1) Auditee has taken corrective action immediately after the identification of a reportable finding. The auditor should:
A. exclude the finding in final report without verifying corrective action.
B. include the finding in the final report
C. verify corrective action and if appropriately closed, same to be excluded from the report.
D. call of inclusion/exclusion to be taken after discussion of finding with auditee management.
B?
(2) How should the IS auditor proceed if prior audit report is without work papers?
A. Postpone the audit till workpapers are available.
B. Continue audit while relying on previous audit report.
C. Controls for highest risk area to be retested.
D. Inform audit management and propose retesting the controls.
D?
(3) Auditor should hold the closure meeting with the objective of:
A. discussion on audit observations.
B. correction of deficiencies.
C. assessing audit staff performance.
D. presenting the final audit report.
A?
(4) For communication of audit results, IS Auditor is ultimately responsible to:
A. Legal Authorities
B. Senior Management and/or audit committee
C. manager of the audited entity
D. compliance manager
B?
(5)Auditor should hold the closure meeting with the objective of:
A. Allowing auditees to implementing recommendations as soon as possible
B. Allowing auditors to explain complicated findings before a written report is issued
C. Allowing auditors to buy confidence of management.
D. To ensure that there have been no misunderstandings or misinterpretations of facts
D?
(6) In case of non-agreement by department manager over audit findings, which of the following should be the first action?
A. Once again test control to validate the audit finding.
B. Ask a third party to validate the audit finding.
C. Include the finding in the report with the department manager’s comments.
D. Revalidate the supporting evidence for the finding.
D?
(7) Main reason for meeting with auditees prior to formally release the audit report is to:
A. ensure all important issues are covered.
B. gain agreement on the findings.
C. to obtain feedback on audit procedures.
D. to finalise structure of final audit report.
A?
(8) IS auditor finds that critical disaster recovery plan (DRP) does not cover all of the systems. IS Auditor should:
A. inform the management and evaluate the impact of not covering all the systems.
B. postpone the audit.
C. continue audit of existing disaster recovery plan (DRP)
D. call for explanation from management for not covering all the systems.
A?
(9) Main reason for meeting with auditees prior to formally release the audit report is to:
A. seek management approval for corrective action plan.
B. validate accuracy of the audit findings.
C. provide assistance to management in implementation of corrective actions.
D. prioritize the resolution of audit findings.
B?
(10) While reviewing an application, IS auditor observed minor weakness in database which is out of the scope for the audit. IS auditor should:
A. include that database in the scope.
B. note down the weakness for future review.
C. work with database administrator to correct the weakness.
D. report the weakness in the audit report.
D?
(11) While reviewing a finance application, IS auditor observed major weakness in change management application supporting the finance application. IS auditor should:
A. continue review of finance application and report deficiency of change management application to IT manager.
B. complete review of finance application and ignore deficiency as it is not part of the audit scope.
C. formally report deficiency in audit report.
D. cease audit activity until deficiency is corrected.
A?
(12) Which of the following is the MAIN objective of an IS auditor discussing the audit findings with the auditee:
A. briefing about audit results.
B. finalizing timelines for corrective actions.
C. confirming audit findings and propose a course of corrective action.
D. identifying compensating controls for the audit findings.
C?
(13) IS auditor is reviewing critical application prior to implementation. Vulnerability assessment and penetration test by security experts are in process and results will not be available prior to implementation. Which of the following is the BEST option for the IS auditor?
A. issue the audit report on the basis of available information highlighting the potential security weakness and the requirement for follow up audit testing.
B. issue the audit report ignoring the areas where evidence are not available.
C. request for delay of implementation date until evidence are available.
D. cease the audit due lack of evidence.
A?
(14) IS auditor observed inadequate controls for remote access for a critical application. Management disagrees stating that intrusion detection system (IDS) and firewall controls are in place. Which of the following is the BEST option for the IS auditor?
A. Revised the finding considering management views.
B. Withdraw the finding because the IDS controls are in place.
C. Withdraw the finding because firewall rules are monitored
D. Document audit findings in the audit report.
D?
(15) IS auditor should ensure that the audit findings are supported by:
A. response from auditee management
B. risk assessment document of the organization.
C. audit evidence.
D. work papers of other auditors.
C?
